Privacy Machiavellis

Chris Jay Hoofnagle has a piece up at SFGate.com on what he calls the "privacy Machiavellis," which are exemplified by Google and Facebook. (The article is adapted from a longer treatment published last year, called "Beyond Google and Evil.") Hoofnagle heads the privacy foundation set up with money collected from settlements of privacy lawsuits against Facebook. From SFGate: "... you have no way to ask Google to stop this tracking. Instead, you can merely opt out of the targeted advertising — the product recommendations. Exercising your privacy options creates a worst-case-scenario outcome: If you opt out, you are still tracked, but you do not receive the putative benefit of targeted ads. An illusory opt-out system is just one of the increasingly sophisticated sleights of hand in the privacy world. Consider Facebook's privacy options. ... Facebook can proudly proclaim that it offers ... more than 100 [choices]. Therein lies the trick; by offering too many choices, individuals are likely to choose poorly, or not at all. Facebook benefits because poor choices or paralysis leads consumers to reveal more personal information. In any case, the fault is the consumer's, because, after all, they were given a choice. Reader Kilrah_il sends word that Google has just released a tool that could alleviate some of the above worries: it stops tracking by Google Analytics for users of IE7+, Firefox 3.5+, and Chrome 4+. Perhaps Hoofnagle will comment on it here or elsewhere.

Comments

Machiavellis indeed

[homer_s]

An illusory opt-out system ... Therein lies the trick; by offering too many choices,

Of course, you can exercise the one opt-out system that works - don't use their services. Nobody is holding a gun to your head. It is like buying a car, but not wanting to pay the price. The price of working with Google and Facebook is not dollars, but your data.

Google's price/benefit is right for me, so I use it. Facebook's is not, so I don't.

Re:Machiavellis indeed

[postbigbang]

Nicely stated.

Yet civilians still need protection from things they don't understand. We do have a choice. We can and do opt out. But even black-belt geeks that desire privacy have a hard time figuring this stuff out. It's like the 32 page credit card agreement conundrum. Simple protection of the innocent demands safety for them. We're supposed to be the 'good guys'. Good guys help protect those that can't protect themselves, not leave them to the wolves. There is evil in such trickery.

Re:Machiavellis indeed

[Miros]

That makes sense in an opt-in framework, but not in an opt-out framework.

Re:Machiavellis indeed

[dcollins]

"Of course, you can exercise the one opt-out system that works - don't use their services. Nobody is holding a gun to your head. It is like buying a car, but not wanting to pay the price. The price of working with Google and Facebook is not dollars, but your data... Google's price/benefit is right for me, so I use it. Facebook's is not, so I don't."

So, basically a free-market argument. However, the free market only works based on an assumption of full information on behalf of all parties. So inasmuch as companies such as these withhold information, or obscure what they're doing, or drown the client in a deluge of fine print, many people will be kept ignorant of the true cost (whether in dollars or data or anything else).

This is enormously similar to how credit-card companies, EULA writers, shady mortgage lenders, etc., all operate. When free-market assumptions break down, the only remaining solution is organized political action.

Re:Machiavellis indeed

[Anonymous Coward]

To the people who mod this insightful. Go fuck yourself.

Are you saying that because I'm not a lawyer...because I was *only* reading at a 12th grade level at age 8...that I should:

    - not be able to purchase a car?
    - not be able to buy internet service?
    - never own a home?
    - have to spend days researching my new apartment complex to see which terms of the lease count, and which are merely unenforceable?
    - not even be able to *use* the average operating system, save a BSD licensed one? I'm sorry--The GPL contains terms of the art that require a subtle and nuanced understanding to even start to comprehend. Don't get me started on windows licensing agreements...
    - not be able to own phone service
    - not be able to participate meaningfully in social life because many services are only available with a credit card or bank account, each coming with their own 10-20 pages of small print which make liberal use of terms of the art.

No. That's a load of shit. In point of fact, 99% of the world probably outright *IGNORES* the legalese that occurs in day to day life. And if there was any justice--juries and judges would throw it out for exactly that reason. The reasonable, ethical, responsible expectation is the doctrine of first sale and nothing more. No loss of rights, no restrictions on what you can do with it, how or when.

And the same goes for marketers. Privacy information is provided in a complicated, convoluted manner to hide the plain and simple fact that their agreements amount to "once you give us the data, we can do what we damned well please with it, as long as it isn't illegal (and if the law changes, we will do it)"

Participating in society in a routine and typical basis should require no more legal comprehension than is typical. And if that means that I "have to understand" my cellphone agreement--it should be nullified and unenforceable.

The ridiculous attitude that "You don't have to do X, so I can ask for anything I damned well please for it, collude with others to ask for it, and no, you aren't free to compete because I have a revolving door patent agreement updated every year, but never filed--and I enjoy my monopoly agreements on service with local governments" needs to be set on fire and shot at a social level.

Not . It's not over till it's burned alive.

Re:Machiavellis indeed

[Jah-Wren Ryel]

Of course, you can exercise the one opt-out system that works - don't use their services.

Then you might as well not use most of the web. Do you know how many websites embed the google-analytics code? Hundreds of thousands of them. Basically any website that can't afford to role their own or contract out for a paid service will use google-analytics for user-traffic tracking.

So your answer is completely unfeasible in the real world.

Noscript

[Anonymous Coward]

Noscript stopped Google Analytics a long time ago!

Re:Privacy paranoia

[gurps_npc]

People are not filming and recording you walk down the street (at least not all controlled by a single company, not in america). All the information in one place makes it easy to abuse. If you do a search you can easily find tales of IRS agents abusing their authority to look up info on celebrities, political candidates, and even their ex-wives. When you record, then people can use it later and yes they can eliminate the anonymousity later. But there are already addons like Noscript and Ghostery to stop Google from getting quite so thorough a record of you. Of course, chances are your ISP will still have a good record, but at least it is not one single company controlling all that privacy for everyone. Which severely limits the abuse potential

Machiavellian == unjust slander

[handy_vandal]

The term "machiavellian" is a cruel and unjust slander.

Niccolò Machiavelli was a profoundly moral man, well acquainted with -- and appalled by -- the amoral power politics of his age. When he wrote that a Prince should prefer to be feared, rather than loved, Machiavelli was not advancing a personal ideal: he was simply reporting how Princes actually behave in the real world.

Re:Privacy paranoia

[Anonymous Coward]

Paranoids are people who think they are much more important than they really are.

And idiots are people who think "paranoid" means "more concerned about privacy than I am".

Re:Protect your privacy

[OrwellianLurker]

IS THAT YOU ZUCK?

host blocking

[ya really]

I've been adding the following to my desktop computer host files for over a year to block google's tracking:

127.0.0.1 partner.googleadservices.com
127.0.0.1 google-analytics.com
127.0.0.1 ssl.google-analytics.com
127.0.0.1 googleadservices.com
127.0.0.1 googlesyndication.com
127.0.0.1 pagead2.googlesyndication.com
127.0.0.1 www.google-analytics.com
127.0.0.1 video-stats.video.google.com
127.0.0.1 wintricksbanner.googlepages.com
127.0.0.1 www-google-analytics.l.google.com

I trust that solution more than I do google's opt-out bs. If you want to get fancy, you can direct a lightweight web server like lighttpd to 404 the adservers to load your pages a bit faster (instead of letting them time out) and to keep logs of what adservers are trying to load.

Re:"targeted advertising" is NOT a benefit to ME

[vlm]

I don't care if the advertisers think it's a benefit. It doesn't benefit me

If it'd FUD scare tactics, or lifestyle promotion trash, sure. If its informational, thats a whole nother matter.

I'm in the market for a vacuum cleaner. I'm pretty hot to get a Dyson at this time. The commercials suck. Mostly I want high suction and I am so thru with buying bags and filters.

I wouldn't mind some "targeted ads" on this topic.

Given the enormous amount of advertising money spent to reach people whom don't give a $#*!, you'd think amazon or something would set up a service where companies pay me money to examine their marketing crud, paid to me at time of sale on amazon. I'd sit there and watch an "electrolux" or whatever commercial for $1. And they'd probably pay me $1 since I'm hot to buy a vacuum cleaner, and amazon would only clear the money to me if I actually bought someones vacuum cleaner (not necessarily theirs). Essentially a reverse ebay auction, where the companies bid on me to get me to watch their ads, and I prove I'm serious by purchasing "someones" product.

memorize a fake person

[circletimessquare]

there is a fake me out there, with a fake name, a fake birthday, a fake home address, a fake mother's maiden name, a fake birth city, fake likes and dislikes, etc. every time i am asked for this info online, i consistently and continually use the fake alter ego

this is the future of privacy: aliases

Re:memorize a fake person

[Kittenman]

But .... isn't this like saying that the "Iliad" wasn't written by Homer, but another Greek of the same name?

If the fake-you does the stuff you do and you get targeted for it, then the fake-you is you. You just appear to be someone differently named on the internet.

Re:Too Many? Seriously?

[citylivin]

"Tomorrow when they get the unspoken mythical number correct"

How obtuse you are. I have tried to trick out my girlfriends facebook privacy settings, but it seems there is always another page somewhere that you have to hunt for. Also, there is no quick and easy way to opt out of everything. You have to go to every app, every website that has a facebook tie in, every picture gallery, etc and change them ALL manually to opt out of "sharing my information with anyone who asks" mode.

Its complete bullshit. sure, you can go into your filesystem ACLs and hand edit every file to have the correct permissions. No one does this however, and thats why you can apply permissions/acls RECURSIVELY from parent. What I would want for her is a big button that opts out of EVERYTHING. Add to that a nice concise privacy page. Note how i said PAGE, not pageS spread across the entirety on the site. Then I would say, add as many fiddily little options as you want. So long as the giant opt out button still works for them all, and when they add new features, they don't opt you in automatically, as is currently the case.

I have always hated facebook, but I didnt know the true hate till i went to ehow.com - or any number of a growing pool of "facebook connect" sites, and saw a picture of my girlfriend on there with the option to leave a comment about the site.
What the fucking fuck! i still havent been able to turn that "feature" off yet, because i cant find the damn option! Aparently, if you have logged onto facebook (that day?), you are automatically "connected" to a host of other sites. So now i have to go to facebook and make sure my gf is logged out, every time i use the computer.

Perhaps you could think of it as akin to a program which has zillions of undocumented commands. Amazingly powerful and yet completely useless at the same time. Sure some people have cracked the correct syntax to get facebook to perform the stop-auto-tie-in-to-all-garbage-sites option, but why the fuck should it be so hard?

There is only one answer and one alone - deliberate obscurification and mis direction. It is the same answer as to why everything is opt OUT instead of opt IN on facebook. They rely on people being too lazy, confused and stupid to care.

So stop apologizing for what is at best bad UI design, and at worst willful obscurification that leads too (surprise!), expanded profits for facebook.